An input-constrained device is hardware that cannot easily support normal text entry or a full web browser. Common examples include smart TVs, printers, kiosks, and some IoT equipment. Because typing long passwords or navigating complex login pages is impractical, these devices often rely on simplified authentication methods such as device codes, companion apps, or browser handoff to another device.
This matters in cyber security because convenience features can expand the attack surface. In OAuth device flows, a user may enter a code on a separate browser while the constrained device waits for authorization. Attackers abuse that design by tricking users into approving a session they did not intend to create, leading to token theft rather than password theft. Defenders reduce risk by limiting device-code sign-ins, enforcing strong policies on approved devices, reviewing logs for unusual authorization events, and revoking tokens quickly when misuse is suspected.